Group polict changes take 5+ reboots to take effect.

[starscream]

After I make a GPO change i run gpupdate in cmd and then reboot the machines affected, however, it can take up to 5+ reboots before the policy changes take effect. This is especially annoying when deploying software. Is there a way I can speed this process up? All my clients run SP2 and other updates, I heard firewall settings can affect this but I have used a GPO to disable the firewall so it shouldn't be a problem anymore.

 

I also use ranger.

 

Server 2003 Standard as DC

 

Any ideas?

[dezt]

I run a similar network without ranger though, when you run gpupdate from command prompt do you use the "/force" switch?

 

I run gpupdate /force and it works after the first reboot.

[starscream]

i don't! Should I? I'll try it now...

[starscream]

Ah it took longer to refresh, didn't work first boot but the machines were rebooting as I did it. Will reboot em all again...

[chrisa]

How many domain controllers do you have? And are you making the Group Policy changes in ranger or directly in Active directory?

[starscream]

direct in AD as they are changes ranger doesn't allow such as log on options etc...

 

1 DC

[chrisa]

It might be worth checking the Event log on one of the client PC's to check that you arn't getting any timeouts on logon. If you are it could be a DNS issue

[starscream]

noooo! Thought I sorted all DNS issues.... will check the logs

[starscream]

OK I checked the logs and all is good. It even says that the security policy was successful.

 

I have even removed the GPO completely that defined the setting.

 

The setting I am having trouble with is the message at log on. I put up my own message warning people of an e-safety policy agreement. I decided I no longer wanted this and removed the policy but I still get the windows up when the computer has booted but this time it seems to have defaulted back to a one I did not write but is similar and says network information: logging onto this workstation indicates an acceptance of the network usage policy.... I did not write this and I have done everything I can to remove it. I have completely removed any policies with logon policy changes. I have forced the update and rebooted the machines many times and it just wont go away!

 

HELP!!!

[chrisa]

Are you running Server 2003? If you are download GPMC from the microsoft site.

 

You can use this to see what policies are effecting certain OU's just to make sure that you haven't missed it somewhere in AD

[plexer]

Patience is the key here.

 

Don't make a change and then immediately reboot something and expect it to work.

 

There are various timings for relpication and group policy refreshes.

 

Ben

[starscream]

I am already ysing GPMC on server 2003

 

It is just strange how it has suddenly gone to some sort of a default network usage message after I removed my custom one from the policy.

 

Do you think it will go in time then? I have rebooted many times and it still stays there. I have checked everything to check that there are no policy settings elsewhere that could be doing this and there isnt.

 

My only other thoughts are like plexer said, to wait or if ranger has decided to put this message on and there is an option to remove it in ranger, but I dont think there is.

[starscream]

FIXED IT! Being the numpty that I am I didn't realise that Ranger has a setting for this under computers. I think that when I set this as a GPO setting it triggered the ranger setting to kick in. When I took the GPO away the ranger one stood.

[Slartibartfast]

This is possibly not entirely relevant to this problem, but gpupdate /sync will force *all* group policies to reapply. gpupdate /force will only force the application of settings which have changed.

[starscream]

I'll try sync, as I did find that it was ranger that was causing the message, but still the message stayed there! I'll try it and report back

[fooby]

To be honest i thought the title of this thread was a statement... not a question.

 

I can fully see that group policy changes can take 4 or 5 reboots. Usually thats about normal.

 

fooby.

[dezt]

I've just created a new GPO and added it to a OU, a quick run round typing in gpupdate /force on the computers and they asked if I want to reboot, after that the software I wanted started to deploy on bootup.

[srochford]

If, like me, you need the exercise then running round doing the gpudate /force is a great idea :-)

 

If you want a quiet life, then psexec is your friend.

 

psexec \\computername gpupdate /force /boot

 

will save the exercise! (Stick 1 per computer in a batch file and do the lot in one go)